← News
/DISPATCH · 2026-09-12

Novo Nordisk 1.3TB Data Breach: Frontend JS Hardcoded GitHub Token Opened 1,000 Private Repos

Ransomware group FulcrumSec disclosed that Azure DevOps and GitHub tokens hardcoded in frontend JavaScript on two of Novo Nordisk's public sites granted access to internal systems, ultimately stealing ~1.3TB of data.

Ransomware and data-extortion group FulcrumSec publicly disclosed that initial access into Danish pharmaceutical giant Novo Nordisk came from personal access tokens hardcoded in frontend JavaScript on two public websites. The group claims this granted entry to more than 1,000 private code repositories and the theft of ~1.3TB of data. After Novo Nordisk refused a $25 million ransom demand, FulcrumSec began publishing stolen data in batches on its leak site.

Incident Overview

Victim: Danish pharmaceutical company Novo Nordisk, manufacturer of Ozempic (semaglutide). Attack group FulcrumSec appeared in late 2025, specializing in exposed credentials in cloud environments. Cumulative victims: 28, including Manchester Airports Group, Arup Group, and Global Schools Group. Timeline: access obtained March 2026; Novo Nordisk disclosed unauthorized data copying on 11 June; FulcrumSec claimed it on 13 June; technical details and data published 11 September. The group brands the technique Hardcoded Horrorshow: scanning public frontend code for API tokens and credentials.

Technical Details

Per the group's leak-site write-up, initial access came from two unrelated Novo Nordisk subdomains, different teams and different applications, same basic error: one public site's JavaScript bundle contained a personal access token (PAT) pointing at an Azure DevOps environment; the other site's client-side code contained a GitHub PAT.

The GitHub PAT's impact was significantly amplified: it authorized access to more than 1,000 private repositories, several of which stored hardcoded credentials for production systems—API tokens, database credentials, service-account passwords. Attackers thereby obtained persistent lateral-movement capability in Novo Nordisk's cloud environment.

Using this access, attackers spent ~two months traversing Novo Nordisk's cloud environment, covering AWS and Hugging Face instances and completing data exfiltration. Stolen content allegedly includes source code, AI and machine-learning assets, proprietary information on marketed and pipeline drugs (Amycretin, CagriSema, and other obesity and diabetes pipeline assets), and pseudonymized information on ~11,500 research subjects from SELECT, FLOW, SOUL, FOCUS semaglutide trials and ONWARDS insulin trials. Lab539 analysis indicates the group operates custom scanning infrastructure that automatically discovers and validates exposed credentials.

Impact Assessment

Core issue is credential hygiene, not a product bug. Minified JavaScript is still fully readable text; extracting tokens requires string matching, not cryptographic breaking. A single overly scoped PAT can escalate one site's frontend mistake into a cross-cloud lateral channel.

The 1.3TB includes clinical-trial and pipeline-drug materials of potential value to competitors. Pseudonymized data is hard to re-identify without a master key. Novo Nordisk said it is aware of claims that data has been published, that primary platforms remain operational, and that it is communicating with relevant regulators.

Remediation

References